You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This is not just a request to bump a dependency for a CVE
This is not solely a request to bump a dependency for a CVE
Current Behavior
Under install-strategy=linked, an optional native binding is installed and symlinked in the store and resolves at runtime, but napi-postinstall run from a consumer package's own store directory reports the binding missing (Failed to find package "@unrs/resolver-binding-darwin-arm64") and tries to re-install it. It is non-fatal only because the public registry serves the binding tarball; on a restricted/proxy registry the re-download fails. The hoisted strategy places the binding at a reachable top-level location and the same check passes silently.
Expected Behavior
A consumer package's installed optional native binding should be resolvable from napi-postinstall's vantage point under the linked strategy, without triggering a redundant re-download, matching the hoisted strategy.
Steps To Reproduce
cd"$(mktemp -d)"echo'install-strategy=linked'> .npmrc
cat > package.json <<'EOF'{ "name": "napi", "version": "1.0.0", "dependencies": { "unrs-resolver": "1.11.1" }, "allowScripts": { "unrs-resolver": true, "napi-postinstall": true } }EOF
npm install >/dev/null
cd node_modules/.store/unrs-resolver@*/node_modules/unrs-resolver
node ../.bin/napi-postinstall unrs-resolver 1.11.1 check
# linked: [napi-postinstall] Failed to find package "@unrs/resolver-binding-darwin-arm64" ... Trying to install# (require.resolve from the same dir finds the binding; hoisted's check passes silently)
Activity
manzoorwanijk commentedon Jun 24, 2026
Seems to be already resolved by #9551.